CVE-2014-8003

Cisco Integrated Management Controller in Cisco UCS 2.2(2c)A and earlier is affected by CVE-2014-8003 due to improper input validation in the map-nfs command. This allows an authenticated, local attacker to gain shell-level access to the device. The issue is tied to Bug CSCup05998. Cisco’s adviso...

CVE-2014-3407

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.3.2 and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service memory consumption via crafted packets, aka Bug ID CSCuq68888...

Design/Logic Flaw

The SSL VPN implementation in Cisco Adaptive Security Appliance ASA Software 9.3.2 and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service memory consumption via crafted packets, aka Bug ID CSCuq68888...

Race condition

Race condition in the lighttpd module in Cisco IOS XR 5.1 and earlier on Network Convergence System 6000 devices allows remote attackers to cause a denial of service process reload by establishing many TCP sessions, aka Bug ID CSCuq45239...

CVE-2014-8005

The CVE-2014-8005 entry concerns a race condition in the lighttpd module of Cisco IOS XR (5.1 and earlier) running on Network Convergence System 6000 devices. The vulnerability allows an unauthenticated, remote attacker to cause a denial of service by establishing many TCP sessions to the lighttp...

CVE-2014-8004

Cisco IOS XR allows remote attackers to cause a denial of service LISP process reload by establishing many LISP TCP sessions, aka Bug ID CSCuq90378...

Design/Logic Flaw

Cisco IOS XR allows remote attackers to cause a denial of service LISP process reload by establishing many LISP TCP sessions, aka Bug ID CSCuq90378...

CVE-2014-8004

Cisco IOS XR allows remote attackers to cause a denial of service LISP process reload by establishing many LISP TCP sessions, aka Bug ID CSCuq90378...

CVE-2014-8000

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

Code injection

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

CVE-2014-8000

CVE-2014-8000 affects Cisco Unified Communications Manager IM and Presence Service 9.1(1). The vulnerability arises from improper sanitization of returned messages, causing different URL responses depending on whether a username exists, enabling remote attackers to enumerate valid user accounts v...

CVE-2014-8000

Cisco Unified Communications Manager IM and Presence Service 9.11 produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Integrated Management Controller in Cisco Unified Computing System allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuq45477...

CVE-2014-7996

Cisco UCS Integrated Management Controller CIMC is affected by a CSRF vulnerability (CVE-2014-7996) in its web framework. An unauthenticated, remote attacker can perform a CSRF attack and hijack user sessions. The issue stems from insufficient CSRF protections in CIMC’s web interface. Impact as d...

CVE-2014-7992

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014...

Design/Logic Flaw

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014...

CVE-2014-7992

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensitive credential information from process memory via a session on TCP port 2067, aka Bug ID CSCur14014...

Code injection

Cisco IOS on Aironet access points, when "dot11 aaa authenticator" debugging is enabled, allows remote attackers to cause a denial of service via a malformed EAP packet, aka Bug ID CSCul15509...

Input validation

The DHCP implementation in Cisco IOS on Aironet access points does not properly handle error conditions with short leases and unsuccessful lease-renewal attempts, which allows remote attackers to cause a denial of service device restart by triggering a transition into a recovery state that was...

CVE-2014-7997

The Cisco Aironet DHCP vulnerability CVE-2014-7997 affects the DHCP subsystem of Cisco Aironet access points. It occurs when handling very short DHCP leases and failed renewals, which can trigger a recovery path that restarts the entire device instead of only the network interface. An unauthentic...